Pro-Russian Hacktivist Group TwoNet Exposed for Fabricating Critical Infrastructure Attacks to Boost Reputation

Forescout Research has uncovered that the pro-Russian hacktivist group TwoNet fabricated real-world critical infrastructure attacks to inflate its reputation, beginning activity in September 2025 after launching a Telegram channel.

According to Forescout, the group targeted a water treatment utility honeypot and then falsely claimed responsibility for a real attack on its Telegram channel; telemetry shows the intrusion originated from a German hosting provider (AS58212) and involved logging into an HMI with default credentials before a sequence of SQL queries to enumerate databases and subsequent disruptive actions.

During the compromise, the attackers created a new user named “BARLATI” and carried out defacement, disruption, and manipulation, including CVE-2021-26829 exploitation to alter the HMI login page and the deletion of connected PLCs, with logs and alarms disabled to evade detection.

Forescout notes that the group did not escalate privileges or exploit the underlying host, focusing instead on the web application layer of the HMI, and intelligence from Intel471 and Forescout indicates TwoNet had previously operated DDoS activity before shifting toward OT/ICS targets. By late September, TwoNet signalled its closure on affiliated channels, highlighting the ephemerality of hacktivist ecosystems and their tendency to rebrand or join other groups to persist.